Overview
overview
7Static
static
3075232b2c7...18.exe
windows7-x64
7075232b2c7...18.exe
windows10-2004-x64
7iconAnimate.exe
windows7-x64
1iconAnimate.exe
windows10-2004-x64
1iconTips.exe
windows7-x64
1iconTips.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3wukong.exe
windows7-x64
1wukong.exe
windows10-2004-x64
1Analysis
-
max time kernel
54s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 09:18
Static task
static1
Behavioral task
behavioral1
Sample
075232b2c7f732b51188290a88bdde55_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
075232b2c7f732b51188290a88bdde55_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
iconAnimate.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
iconAnimate.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
iconTips.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral6
Sample
iconTips.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
uninst.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
uninst.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
wukong.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
wukong.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
iconAnimate.exe
-
Size
215KB
-
MD5
1184e1bbe9c54c05f0536ca26b435d8c
-
SHA1
dbb4e8467b4386a8908f605961680fb4c3860a32
-
SHA256
200a4f5bfe095ae992e8a4aa231417d330f68aa0dd7bb240f2664c6219373dda
-
SHA512
4c7011c7f28b780a9dd2edcdc2c7b2516cab4cd76c3d394e26da12d9f2976e98ec0efeb6a0267ec34c199b3104a90a2ed453b7783bde84de0e79eef29ad351f4
-
SSDEEP
6144:RkntLMgd3mG/fRTbuP/Ek2Dt64UUUSUdgp:Rktogd3m+T6PRqt64UUU1dY
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1692 iconAnimate.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56 PID 1692 wrote to memory of 3412 1692 iconAnimate.exe 56